diff --git a/backend/app/api/users.py b/backend/app/api/users.py index 57f594d..991e685 100644 --- a/backend/app/api/users.py +++ b/backend/app/api/users.py @@ -95,6 +95,12 @@ async def change_user_status( status_code=403, detail="Cannot manage users outside your class" ) + # Only super_admin can change roles + if data.role and admin.role != "super_admin": + raise HTTPException( + status_code=403, detail="Only super admin can change user roles" + ) + updated = await update_user_status(db, user_id, data.status, data.role) # Send email notification diff --git a/frontend/src/app/(app)/admin/members/page.tsx b/frontend/src/app/(app)/admin/members/page.tsx index 43baa29..92ffc6b 100644 --- a/frontend/src/app/(app)/admin/members/page.tsx +++ b/frontend/src/app/(app)/admin/members/page.tsx @@ -481,23 +481,27 @@ export default function MembersPage() {

- v && handleRoleChange(m.id, v)} + > + + + {ROLES[m.role as keyof typeof ROLES] || m.role} + + + + 同学 + 班级管理员 超级管理员 - )} - - + + + ) : ( + + {ROLES[m.role as keyof typeof ROLES] || m.role} + + )} {getStatusBadge(m.status)} {m.status === "approved" && (